blackBesides medical image datasets, we evaluate SMIA on a hand-written image dataset MNIST [1]} with existing methods. Table REF  shows the results. Our SMIA method decreases the recognition accuracy more than that of FGSM and PGD. This indicates that SMIA is effective to attack not only medical images, but also images from other fields.
